All Tools
SecurityFree

Locks the doors, and tells you which ones were open.

Security switches on with no set-up. It checks your site for weak spots and says how to fix each one, locks out repeated wrong passwords, sets sensible password rules and turns away the scanners that probe every site on the internet.

Get started freeTry it in 5 minutes
A bunch of keys hanging in a door lock

What Security does for you

A health check

People, sign-in, server, web and licences, each check saying what is weak and how to fix it.

Sign-in lockout

Five wrong passwords lock an account, twenty lock an address, for longer each time. Refusals never reveal whether an account exists.

Password rules

At least ten characters, none of the 10,000 most common passwords, and not your own name or email.

Scanners turned away

Requests for WordPress files, .env, .git and the like get a bare 404, and repeat offenders are blocked for an hour.

Every sign-in logged

Successes, failures and password reset requests, filtered by period and exported as CSV.

Told when it matters

Notices for lockouts, a success after many failures, and reset requests that look like probing.

See it

The Security overview with a health score of 91 per cent, today's figures and the checks
Overview. A health score, today's figures and each check with how to fix it.
The Sign-ins tab filtered to failed sign-ins, with wrong passwords for one account and made-up admin accounts from a script
Sign-ins. Filtered to failures: someone guessing one account's password, and a script trying made-up admin accounts. Search, filter and export as CSV.
The Blocked tab with a locked account, two addresses blocked for probing and two blocked by hand
Blocked. An account locked after wrong passwords, two scanners blocked for probing, and addresses blocked by hand.
Security settings for sign-in lockout, password rules and scanner blocking
Settings. How many wrong passwords lock an account, the password rules, and when a scanner is blocked.

Screens from our ACME Ltd demo site. Every name and figure in them is made up.

Try it in 5 minutes

  1. Install Domma CMS. Security is on from the start.
  2. Open Security in the sidebar and read the health check.
  3. Fix the items marked for attention; each one says how.
  4. Look at Sign-ins for the last 24 hours, then Blocked for addresses turned away.
  5. Open the cog to tune lockout thresholds, the password policy and which notices you receive.

Need more protection? Security Pro

Security Free

  • Health check with fixes
  • Sign-in lockout and password rules
  • Scanner blocking
  • Sign-in and reset log with CSV
  • Manual block and unblock

Security Pro Pro adds

  • Two-factor sign-in, required per role if you wish
  • A firewall that bans repeat offenders for longer
  • Per-route rate limits
  • Country rules for the admin
  • Breached-password checks
  • Every signed-in session, audit trail and file integrity checks

Good to know

Locked yourself out? A command-line unlock tool clears a lockout within seconds.

What it needs

Nothing. Security is free, ships with Domma CMS and switches itself on.

Questions

Addresses that signed in during the last week, and the server itself, are never blocked automatically.

The scanner guard fails open: if it cannot decide, the request goes through rather than your site going down.

Learn it step by step

Locking down sign-inTutorial - Beginner - 15 min

Goes well with

Security ProTwo-factor and a firewallPro FeedbackTell us, see what happenedFree SEOGet found, page by pageBuilt-in
Something Security does not do?

Ask Daisy for a Tool of your own, or Dot to build the pages around it.

Meet Dot and DaisyTool Builder, £59 a monthSite Builder, in Pro

Security is free with every site

Every Domma CMS site starts protected. Install it and read your health check.

Get started freeBrowse all Tools